Executive brief
SolidInvoice is an open-source platform used by businesses to manage invoicing, clients, and payments. A security flaw was identified where the secret tokens used to access the system's programming interface (API) were stored in the database as plain text rather than being securely scrambled. If an attacker gains access to the database—for example, through a separate security breach or a leaked backup—they could steal these tokens to impersonate users and access sensitive financial records or modify business data.
Technical details
SolidInvoice prior to version 2.3.17 suffers from CWE-312 (Cleartext Storage of Sensitive Information). While API tokens are generated with sufficient entropy, they are stored as raw strings in the `api_tokens` database table and authenticated using simple plaintext equality checks in `ApiTokenRepository.php`. An attacker who gains read access to the database via SQL injection, misconfigured backups, or insider access can retrieve these tokens to perform unauthorized REST API requests. The vulnerability has been addressed in version 2.3.17 by migrating to HMAC-SHA256 hashing (keyed by the application secret) for token storage and verification.
Affected products
- SolidInvoice SolidInvoice <= 2.3.16
Timeline
- 2026-05-15: patched: Fix committed to repository
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-11: disclosed: CVE published to NVD